Internet Security Threats

Trojan.Win32.Pandora.l

RISK LEVEL:2

This Trojan has a malicious payload. The Trojan is a Windows PE EXE file.It is 4,096 bytes in size.

Installation

When launched, the Trojan copies its executable file to the Windows root directory:

In order to ensure that the Trojan is launched automatically each time Windowsis restarted, the Trojan registers its executable file in the system registry:

The Trojan also adds the following parameter to the wininit.ini configurationfile:

The Trojan displays the following message:

It then launches the web browser and opens the following link:

It terminates the following process:

This will result in Windows shutting down.

If your computer does not have an up-to-date antivirus, or does not have anantivirus solution at all, follow the instructions below to delete the maliciousprogram:

1. Use Task Manager to terminate the Trojan process (memorium.exe).
2. Delete the original Trojan file (the location will depend onhow the program originally penetrated the victim machine).
3. Delete the copy of the Trojan:
   %WinDir%\memorium.exe
4. Delete the following system registry key parameter:
   [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    "load"="memorium.exe"
5. Delete the following string from wininit.ini:
   ìemorium=memorium.exe
6. Update your antivirus databases and perform a full scan of thecomputer (download a trial version of Kaspersky Anti-Virus).